CVE-2026-50020

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.135.Final Netty versions prior to 4.2.15.Final

Description Before reading the first request-line, the HttpObjectDecoder function silently skips all whitespace and every byte for which Character.isISOControl(b) is true (0x00–0x1F and 0x7F). This behavior deviates from RFC 9112 §2.2, which only permits servers to ignore empty CRLF lines preceding the request-line to handle HTTP/1.0 POST workarounds. By absorbing non-CRLF control characters such as NUL, SOH, and STX, the software can be exploited for request-boundary confusion in pipelined or multiplexed transports. This occurs when a front-end component, such as a load balancer or TLS terminator, treats these bytes differently than Netty, potentially leading to request-desync or smuggling attacks.

Recommendations Update to version 4.1.135.Final. Update to version 4.2.15.Final.